Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.
Lychee versions prior to 7.7.0 have a vulnerability where the GET /docs/api endpoint exposes OpenAPI documentation without authentication and regenerates the schema on each request without caching. This allows remote attackers to repeatedly request the endpoint, causing excessive CPU consumption and revealing detailed API schema information. The issue is fixed in version 7.7.0.
Lychee versions prior to 7.7.0 contain an uncontrolled resource consumption vulnerability in the ImagickHandler::loadPdf() function. An authenticated user can upload a crafted PDF with an oversized /MediaBox, causing excessive CPU usage during image processing. This can lead to denial of service by occupying web workers or clogging the image-processing queue. The issue is fixed in version 7.7.0.
CVE-2026-62679 is a path traversal vulnerability in Lychee, a photo-management tool, affecting versions prior to 7.6.4. Under a specific non-default configuration, authenticated users can exploit improper pathname limitation to read files accessible to the web process, including sensitive application configuration and other users' private images. The vulnerability is fixed in version 7.6.4.
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3.
CVE-2026-61610 is an improper access control vulnerability in Lychee, an open-source photo-management tool. Prior to version 7.6.1, when the photos_star_visibility setting is configured to anonymous, unauthenticated attackers can fetch and modify photos without proper authorization checks. This allows attackers to identify private photos by response differences and change their highlight status, even for photos in private or password-protected albums. The vulnerability is limited to installations using the non-default anonymous star-visibility setting. The issue is fixed in version 7.6.1.
Lychee versions prior to 7.6.1 have an authentication bypass vulnerability due to lack of throttling or lockout on album unlock attempts. This allows unauthenticated attackers to perform unlimited password guesses on password-protected albums, potentially gaining unauthorized access to private photos. The issue is fixed in version 7.6.1.
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.
CVE-2026-57568 is a cross-site scripting (XSS) vulnerability in Lychee, an open-source photo-management tool. Versions prior to 7.6.0 allow authenticated users with album-edit permissions to inject JavaScript URIs in album or photo Markdown descriptions due to unsafe link allowance. This malicious script is rendered and executed when a visitor, including unauthenticated users, clicks the link in a public album. The vulnerability can lead to session data exposure or unauthorized authenticated requests in the victim's browser context. This issue is fixed in Lychee version 7.6.0.
Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('user_group_id') clause to escape the ownership filter applied by the when() block. Any authenticated non-admin user with upload permission who owns at least one album can retrieve all user-group-based sharing permissions across the entire instance, including private albums owned by other users. This vulnerability is fixed in 7.5.4.
Lychee versions prior to 7.5.3 contain a cross-site scripting (XSS) vulnerability in the photo description field. This field is stored without HTML sanitization and rendered unescaped in RSS, Atom, and JSON feed templates. The publicly accessible /feed endpoint allows any RSS reader to execute attacker-controlled JavaScript. The issue is fixed in version 7.5.3.
Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in `PhotoUrlRule.php` can be bypassed using DNS rebinding. The IP validation check (line 86-89) only activates when the hostname is an IP address. When a domain name is used, `filter_var($host, FILTER_VALIDATE_IP)` returns `false`, skipping the entire check. Version 7.5.2 patches the issue.
Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via `Photo::fromUrl`) contains an incomplete IP validation check that fails to block loopback addresses and link-local addresses. Prior to version 7.5.1, an authenticated user can still reach internal services using direct IP addresses, bypassing all four protection configuration settings even when they are set to their secure defaults. Version 7.5.1 contains a fix for the issue.
Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. When a user unlocks a password-protected public album, the system automatically unlocks ALL other public albums that share the same password, resulting in a complete authorization bypass. This vulnerability is fixed in 7.1.0.
Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose. Consequently, internal network resources—such as localhost services or cloud-provider metadata endpoints—become reachable. The endpoint takes a URL from the user and calls it server-side via fopen() without any safeguards. There is no IP address validation, nor are there any allow-list, timeout, or size restrictions. Because of this, attackers can point the application at internal targets. Using this flaw, an attacker can perform internal port scans or retrieve sensitive cloud metadata. Version 6.6.13 contains a patch for the issue.
Lychee is a free photo-management tool. In versions starting from 6.6.6 to before 6.6.10, an attacker can leak local files including environment variables, nginx logs, other user's uploaded images, and configuration secrets due to a path traversal exploit in SecurePathController.php. This issue has been patched in version 6.6.10.